CVE-2015-6835

critical
New! CVE Severity Now Using CVSS v3

The calculated severity for CVEs has been updated to use CVSS v3 by default. CVEs that do not have a CVSS v3 score will fall back CVSS v2 for calculating severity. Severity display preferences can be toggled in the settings dropdown.

Description

The session deserializer in PHP before 5.4.45, 5.5.x before 5.5.29, and 5.6.x before 5.6.13 mishandles multiple php_var_unserialize calls, which allow remote attackers to execute arbitrary code or cause a denial of service (use-after-free) via crafted session content.

References

http://php.net/ChangeLog-5.php

http://www.debian.org/security/2015/dsa-3358

http://www.securityfocus.com/bid/76734

http://www.securitytracker.com/id/1033548

https://bugs.php.net/bug.php?id=70219

https://security.gentoo.org/glsa/201606-10

Details

Source: MITRE

Published: 2016-05-16

Updated: 2017-11-04

Risk Information

CVSS v2

Base Score: 7.5

Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

Impact Score: 6.4

Exploitability Score: 10

Severity: HIGH

CVSS v3

Base Score: 9.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Impact Score: 5.9

Exploitability Score: 3.9

Severity: CRITICAL

Vulnerable Software

Configuration 1

OR

cpe:2.3:a:php:php:5.6.0:alpha1:*:*:*:*:*:*

cpe:2.3:a:php:php:5.6.0:alpha2:*:*:*:*:*:*

cpe:2.3:a:php:php:5.6.0:alpha3:*:*:*:*:*:*

cpe:2.3:a:php:php:5.6.0:alpha4:*:*:*:*:*:*

cpe:2.3:a:php:php:5.6.0:alpha5:*:*:*:*:*:*

cpe:2.3:a:php:php:5.6.0:beta1:*:*:*:*:*:*

cpe:2.3:a:php:php:5.6.0:beta2:*:*:*:*:*:*

cpe:2.3:a:php:php:5.6.0:beta3:*:*:*:*:*:*

cpe:2.3:a:php:php:5.6.0:beta4:*:*:*:*:*:*

cpe:2.3:a:php:php:5.6.1:*:*:*:*:*:*:*

cpe:2.3:a:php:php:5.6.2:*:*:*:*:*:*:*

cpe:2.3:a:php:php:5.6.3:*:*:*:*:*:*:*

cpe:2.3:a:php:php:5.6.4:*:*:*:*:*:*:*

cpe:2.3:a:php:php:5.6.5:*:*:*:*:*:*:*

cpe:2.3:a:php:php:5.6.6:*:*:*:*:*:*:*

cpe:2.3:a:php:php:5.6.7:*:*:*:*:*:*:*

cpe:2.3:a:php:php:5.6.8:*:*:*:*:*:*:*

cpe:2.3:a:php:php:5.6.9:*:*:*:*:*:*:*

cpe:2.3:a:php:php:5.6.10:*:*:*:*:*:*:*

cpe:2.3:a:php:php:5.6.11:*:*:*:*:*:*:*

cpe:2.3:a:php:php:5.6.12:*:*:*:*:*:*:*

Configuration 2

OR

cpe:2.3:a:php:php:*:*:*:*:*:*:*:* versions up to 5.4.44 (inclusive)

Configuration 3

OR

cpe:2.3:a:php:php:5.5.0:*:*:*:*:*:*:*

cpe:2.3:a:php:php:5.5.0:alpha1:*:*:*:*:*:*

cpe:2.3:a:php:php:5.5.0:alpha2:*:*:*:*:*:*

cpe:2.3:a:php:php:5.5.0:alpha3:*:*:*:*:*:*

cpe:2.3:a:php:php:5.5.0:alpha4:*:*:*:*:*:*

cpe:2.3:a:php:php:5.5.0:alpha5:*:*:*:*:*:*

cpe:2.3:a:php:php:5.5.0:alpha6:*:*:*:*:*:*

cpe:2.3:a:php:php:5.5.0:beta1:*:*:*:*:*:*

cpe:2.3:a:php:php:5.5.0:beta2:*:*:*:*:*:*

cpe:2.3:a:php:php:5.5.0:beta3:*:*:*:*:*:*

cpe:2.3:a:php:php:5.5.0:beta4:*:*:*:*:*:*

cpe:2.3:a:php:php:5.5.0:rc1:*:*:*:*:*:*

cpe:2.3:a:php:php:5.5.0:rc2:*:*:*:*:*:*

cpe:2.3:a:php:php:5.5.1:*:*:*:*:*:*:*

cpe:2.3:a:php:php:5.5.2:*:*:*:*:*:*:*

cpe:2.3:a:php:php:5.5.3:*:*:*:*:*:*:*

cpe:2.3:a:php:php:5.5.4:*:*:*:*:*:*:*

cpe:2.3:a:php:php:5.5.5:*:*:*:*:*:*:*

cpe:2.3:a:php:php:5.5.6:*:*:*:*:*:*:*

cpe:2.3:a:php:php:5.5.7:*:*:*:*:*:*:*

cpe:2.3:a:php:php:5.5.8:*:*:*:*:*:*:*

cpe:2.3:a:php:php:5.5.9:*:*:*:*:*:*:*

cpe:2.3:a:php:php:5.5.10:*:*:*:*:*:*:*

cpe:2.3:a:php:php:5.5.11:*:*:*:*:*:*:*

cpe:2.3:a:php:php:5.5.12:*:*:*:*:*:*:*

cpe:2.3:a:php:php:5.5.13:*:*:*:*:*:*:*

cpe:2.3:a:php:php:5.5.14:*:*:*:*:*:*:*

cpe:2.3:a:php:php:5.5.15:*:*:*:*:*:*:*

cpe:2.3:a:php:php:5.5.16:*:*:*:*:*:*:*

cpe:2.3:a:php:php:5.5.17:*:*:*:*:*:*:*

cpe:2.3:a:php:php:5.5.18:*:*:*:*:*:*:*

cpe:2.3:a:php:php:5.5.19:*:*:*:*:*:*:*

cpe:2.3:a:php:php:5.5.20:*:*:*:*:*:*:*

cpe:2.3:a:php:php:5.5.21:*:*:*:*:*:*:*

cpe:2.3:a:php:php:5.5.22:*:*:*:*:*:*:*

cpe:2.3:a:php:php:5.5.23:*:*:*:*:*:*:*

cpe:2.3:a:php:php:5.5.24:*:*:*:*:*:*:*

cpe:2.3:a:php:php:5.5.25:*:*:*:*:*:*:*

cpe:2.3:a:php:php:5.5.26:*:*:*:*:*:*:*

cpe:2.3:a:php:php:5.5.27:*:*:*:*:*:*:*

cpe:2.3:a:php:php:5.5.28:*:*:*:*:*:*:*

Tenable Plugins

View all (23 total)

IDNameProductFamilySeverity
124996EulerOS Virtualization 3.0.1.0 : php (EulerOS-SA-2019-1543)NessusHuawei Local Security Checks
high
98805PHP 5.6.x < 5.6.13 Multiple VulnerabilitiesWeb Application ScanningComponent Vulnerability
critical
119971SUSE SLES12 Security Update : php5 (SUSE-SU-2015:1633-1)NessusSuSE Local Security Checks
high
91704GLSA-201606-10 : PHP: Multiple vulnerabilitiesNessusGentoo Local Security Checks
critical
91433F5 Networks BIG-IP : PHP vulnerabilities (SOL17377)NessusF5 Networks Local Security Checks
critical
9324Mac OS X 10.9.5 or later < 10.11.1 Multiple VulnerabilitiesNessus Network MonitorOperating System Detection
critical
89967Amazon Linux AMI : php54 (ALAS-2016-670)NessusAmazon Linux Local Security Checks
critical
86829Mac OS X Multiple Vulnerabilities (Security Updates 2015-004 / 2015-007)NessusMacOS X Local Security Checks
critical
86654Mac OS X < 10.11.1 Multiple VulnerabilitiesNessusMacOS X Local Security Checks
critical
86496Amazon Linux AMI : php55 (ALAS-2015-602)NessusAmazon Linux Local Security Checks
critical
86495Amazon Linux AMI : php56 (ALAS-2015-601)NessusAmazon Linux Local Security Checks
critical
86223Slackware 14.0 / 14.1 / current : php (SSA:2015-274-02)NessusSlackware Local Security Checks
critical
86221Ubuntu 12.04 LTS / 14.04 LTS / 15.04 : php5 vulnerabilities (USN-2758-1)NessusUbuntu Local Security Checks
critical
86183openSUSE Security Update : php5 (openSUSE-2015-609)NessusSuSE Local Security Checks
critical
86030Fedora 23 : php-5.6.13-1.fc23 (2015-14978)NessusFedora Local Security Checks
critical
85934Fedora 22 : php-5.6.13-1.fc22 (2015-14977)NessusFedora Local Security Checks
critical
85933Fedora 21 : php-5.6.13-1.fc21 (2015-14976)NessusFedora Local Security Checks
critical
8861PHP 5.4.x < 5.4.45 / 5.5.x < 5.5.29 / 5.6.x < 5.6.13 Multiple VulnerabilitiesNessus Network MonitorWeb Servers
critical
85914Debian DSA-3358-1 : php5 - security updateNessusDebian Local Security Checks
critical
85887PHP 5.6.x < 5.6.13 Multiple VulnerabilitiesNessusCGI abuses
high
85886PHP 5.5.x < 5.5.29 Multiple VulnerabilitiesNessusCGI abuses
high
85885PHP 5.4.x < 5.4.45 Multiple VulnerabilitiesNessusCGI abuses
high
85859FreeBSD : php -- multiple vulnerabilities (3d675519-5654-11e5-9ad8-14dae9d210b8)NessusFreeBSD Local Security Checks
critical